What happened
NVD published CVE-2026-47702 (CVSS 9.1, Critical) describing cleartext storage of sensitive builder API credentials in the TypeBot database.
Why it matters
Compounds the impact of any other TypeBot data-access bug (of which several were published in the same window) since database access alone directly yields usable authentication tokens for the chatbot builder API.
Attack vector
Builder API bearer tokens are stored in the database as cleartext strings rather than hashed/encrypted; an attacker who gains any read access to the database can extract usable API tokens directly.
Affected systems
TypeBot 3.16.1
Mitigation
Upgrade to TypeBot >= 3.17.0; rotate all API tokens after upgrade.